What to do in an Emergency
If you have detected a security event, there are four basic steps to take:
If this concerns a device, disconnect it, but leave it on: Disconnect the system | service | device from the SNS network by pulling out its Ethernet cable or by disabling the wireless adapter. Do not switch the power off.
If this concerns an account, Reset your password: Do so via the SerSe portal. You might be asked to reset it again once that event has been understood.
The Security Team will discuss further steps with you and also get involved other stakeholders if necessary. Together, we will assess the security event impact and consequences, and investigate its origin. Depending on the results of these forensic analyses, further systems | services | devices | accounts might turn out being affected, and the Security Team will follow up with the corresponding persons responsible. Once the security event has been properly understood, it is up to the systems | services | devices | accounts owner to reestablish an operative state.
Usually this means:
Re-install a system | service | device from scratch;
Change the account password;
Review and correct vulnerable software and applications.